LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices



Reply
 
Search this Thread
Old 10-07-2008, 12:28 AM   #1
bkcreddy17
Member
 
Registered: Feb 2008
Location: India-Hyderabad
Distribution: RHEL and Fedora
Posts: 171

Rep: Reputation: 15
scp without authentication and ssh with authentication?


Hi,
When we generate a rsa key it is working for both ssh and scp with out authentication. Is it possible to copy a file or directory from a remote server as a user to local machine with out password using scp and at the same time if we are login using ssh it should prompt for password.
 
Old 10-07-2008, 12:43 AM   #2
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 655Reputation: 655Reputation: 655Reputation: 655Reputation: 655Reputation: 655
You should use a pass phrase to protect your private key. If you use ssh-agent, you only have to enter the pass-phrase once per shell session.
Code:
eval $(ssh-agent)
ssh-add
This will unlock your private key and you can scp or login without a pass phrase.

I don't know how you have the ssh server configured, but if you have both public key authentication and password authentication, I think it will ask for a password before trying public key authentication. You would allow an attacker to use a brute force attack. Stick with public key authentication.

I would also suggest using "AllowUsers", disable root logins and only allow Protocol 2.
 
Old 10-07-2008, 01:45 AM   #3
bkcreddy17
Member
 
Registered: Feb 2008
Location: India-Hyderabad
Distribution: RHEL and Fedora
Posts: 171

Original Poster
Rep: Reputation: 15
Thank you. I got it.
 
Old 10-07-2008, 05:54 AM   #4
bkcreddy17
Member
 
Registered: Feb 2008
Location: India-Hyderabad
Distribution: RHEL and Fedora
Posts: 171

Original Poster
Rep: Reputation: 15
Unhappy

I am able to login and copy for that particular instant. But it is executing when i wrote a script.
Code:
$cat start.sh
eval $(ssh-agent)
ssh-add
Here i entered the password.

This is a cron job for a user jane.
Code:
$sudo crontab -l -u jane
30 23 * * * /bin/sh /home/jane/testcopy.sh
This is in testcopy.sh
Code:
$cat testcopy.sh
scp eric@xx.xx.xx.x1/testfile1 /home/jane/
scp eric@xx.xx.xx.x2/testfile2 /home/jane/
When i checked netstat, connection is establishing. But the files are not getting copied.
 
Old 10-07-2008, 08:51 PM   #5
chrism01
Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.6, Centos 5.10
Posts: 16,324

Rep: Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041
If cron has a problem it usually emails the crontab owner and/or root with a description of the problem.
Use the cli cmds mail or mailx to check.
Also, ad 1,2 or 3 -v options to the scp cmd for debug output.
 
Old 10-08-2008, 01:15 AM   #6
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 655Reputation: 655Reputation: 655Reputation: 655Reputation: 655Reputation: 655
ssh-add needs a pass phrase to be entered. Crontab can be used by a normal user if that user is listed in cron.allow. However, I don't know if cron runs the user's table as that user. Even if it does, the user's environment in the session where "crontab" is run is not the environment used by the cron command. So if you must use cron, then you probably want to use a null pass phrase for your key. Even if you could automate the entry of the passphrase, you would need to have it listed in a file somewhere. So if a cracker can compromise your key, he would as likely to get your passphrase at the same time.

You might consider using a seperate key set for using with cron. (the -i option to ssh to load an identity from a nonstandard location) This way you could use one for where you need to use cron but have a better passphrase protected key for when you manually use ssh.

Last edited by jschiwal; 10-08-2008 at 01:54 AM.
 
Old 10-08-2008, 02:22 AM   #7
bkcreddy17
Member
 
Registered: Feb 2008
Location: India-Hyderabad
Distribution: RHEL and Fedora
Posts: 171

Original Poster
Rep: Reputation: 15
Code:
Even if you could automate the entry of the passphrase.
(the -i option to ssh to load an identity from a nonstandard location)
How do to automate the enty of pass phrase. Is it this
Code:
$ssh -i .ssh/id_rsa mike@192.168.0.44
or
Code:
$ssh -i rsapass mike@192.168.0.44
where "rsapass" is a file containing the rsa password. I tried in both ways but i am not getting.
 
Old 10-08-2008, 02:33 AM   #8
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 655Reputation: 655Reputation: 655Reputation: 655Reputation: 655Reputation: 655
I was suggesting using a passphraseless key pair when using cron, and a stronger pair for using ssh manually. This would allow you to use a protected private key when logging into remote hosts that you don't use use cp with cron.

For cron backup jobs, the host keys are often used instead and the job runs as root.

The -i option is for using a different public/private key pair. It doesn't load the passphrase. You don't want a passphrase written in a file. That defeats its purpose of protecting the private key.

Last edited by jschiwal; 10-09-2008 at 03:06 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
ssh publickey authentication spx2 Linux - Security 11 01-11-2008 06:27 AM
Authentication service cannot retrieve authentication info Moffett67 Linux - Software 3 12-13-2007 04:16 AM
SSH authentication vkmgeek Linux - General 1 04-12-2006 08:40 AM
SSH authentication blmack44 Linux - Security 1 12-31-2004 03:13 PM
SSH Authentication Help kalikoder Linux - Networking 2 07-16-2003 03:10 PM


All times are GMT -5. The time now is 01:52 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration